{"schema_version":"1","data":[{"id":24633,"advisory_id":"d7d8b32d-4195-403a-840a-470a506f435f","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/april-2024-security-releases","source_published_at":"2024-04-03T03:00:00+00:00","published_at":"2026-10-25T06:38:36.986237+00:00","extraction_method":"llm","technologies":["llhttp","node-js","nodejs","undici"],"cve_ids":["CVE-2024-27982","CVE-2024-27983"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js Security Releases — April 3, 2024","summary":"Node.js security releases address two vulnerabilities in the 18.x, 20.x, and 21.x release lines, including an HTTP/2 server crash and HTTP request smuggling. The release also updates llhttp and undici dependencies.","evidence":"Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"The Node.js Project"},"prerequisites":[],"fixed_versions":[{"value":"18.x","evidence":"Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues."},{"value":"20.x","evidence":"Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues."},{"value":"21.x","evidence":"Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues."}],"affected_versions":[{"value":"18.x","evidence":"The 18.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue."},{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue."},{"value":"21.x","evidence":"The 21.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue."}]},{"name":{"value":"llhttp","evidence":"llhttp version 9.2.1 on 21.x, 20.x, and 18.x"},"prerequisites":[],"fixed_versions":[{"value":"9.2.1","evidence":"llhttp version 9.2.1 on 21.x, 20.x, and 18.x"}],"affected_versions":[]},{"name":{"value":"undici","evidence":"undici version 6.11.1 on 21.x"},"prerequisites":[],"fixed_versions":[{"value":"6.11.1","evidence":"undici version 6.11.1 on 21.x"},{"value":"5.28.4","evidence":"undici version 5.28.4 on 18.x and 20.x"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27983","evidence":"Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983)"},{"value":"CVE-2024-27982","evidence":"HTTP Request Smuggling via Content Length Obfuscation - (CVE-2024-27982)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":21250,"advisory_id":"77f3b35e-537b-4344-963d-c0912927d5da","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.20.6","source_published_at":"2025-01-21T17:05:27+00:00","published_at":"2026-10-25T05:41:20.492655+00:00","extraction_method":"llm","technologies":["node-js","nodejs","undici"],"cve_ids":["CVE-2025-22150","CVE-2025-23084","CVE-2025-23085"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.20.6 (LTS)","summary":"Node.js 18.20.6 is a security release fixing HTTP/2 memory leakage and Windows path traversal issues, and updating undici to address insufficiently random values in fetch().","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.20.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"18.20.6","evidence":"Version 18.20.6 'Hydrogen' (LTS)"}],"affected_versions":[]},{"name":{"value":"undici","evidence":"Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)"},"prerequisites":[],"fixed_versions":[{"value":"v5.28.5","evidence":"deps: update undici to v5.28.5"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23085","evidence":"CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)"},{"value":"CVE-2025-23084","evidence":"CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)"},{"value":"CVE-2025-22150","evidence":"CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":24633,"next_before":21250}